Policy / Compliance Exception Request Form

This form is used when a Information Security policy exception is needed.

Department Name

Full Name

Your E-Mail Address

Date Needed

Duration of Need

Policy Exception Description Please include the policy number and description also.

Audience: who will be utilizing the system and data that you are requesting?

Explanation of why the exception is needed. This should include an explanation as to the inability to utilize existing technologies.

Compliance: Is the data held within this system regulated by laws? Consider the following: HIPAA, FERPA, PCI, or NIH Grant regulations.

Data definition: please describe the types of data that will be hosted, processed or used. Assess and then discribe the sensitivity of the data per the sensitive information definition here. http://louisville.edu/security/files/InformationManagementandClassification_Standard.pdf

Mitigation controls: please explain how risks will be mitigated to exceed or be equal to that of existing policy requirements.

Physical security: please list all physical security controls here.

Third party involvement: please include additional information regarding any third party involvement in the use of the data or access to the system.

Maintenance Plan: Be prepared to submit a policy and procedure for conducting regular maintenance on this system prior to approval.

Information Security Office

Policy / Compliance Exception Request Form